Apache HTTP Server mod_http2 (CVE-2026-119618) Vulnerability Response Note November 2026
Updated
Summary
A critical remote code execution vulnerability was disclosed in the HTTP/2 module (mod_http2) of Apache HTTP Server. It affects only servers with HTTP/2 enabled.
Date of publication
November 13th 2026
Description
CVE-2026-119618: a thread-safety flaw in Apache HTTP Server's mod_http2 (versions 2.4.55 through 2.4.70) can corrupt memory and allow an unauthenticated remote attacker to execute code. CVSS 9.8.
Impact
HYCU R-Cloud: not affected. R-Cloud does not use Apache HTTP Server.
HYCU R-Cloud Hybrid Cloud Edition: not affected. The Apache HTTP/2 module is not installed.
Comments
Please sign in to leave a comment.